fedomex[.]com

Analysis of fedomex.com, observed as offline as of July 23 2026, shows a recent infrastructure supporting a brand‑impersonation campaign targeting x.com. The domain was registered on 21 February 2026 and immediately resolved to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is identified as WE1, indicating a valid‑looking HTTPS endpoint. The page title returned from the site, “Fedomex: Elon Musk’s Official Crypto Casino Powered by Blockchain”, aligns with the declared scam type of a crypto‑related fraud.

The campaign uses the publicly known “Gambler Scam” phishing kit, a template frequently employed to lure victims into cryptocurrency investment schemes. VirusTotal scans have recorded 13 detections out of 93 security vendors, confirming that multiple anti‑malware engines flag the domain as malicious. The domain is listed on at least one security blocklist and has been actively blocked by the PhishDestroy service. The site impersonates x.com, suggesting that any communications referencing the brand may be spoofed to drive users toward the fraudulent casino offering.

While the offline status indicates the current hosting has been taken down, the rapid creation date and the use of a reputable CDN point to a short‑lived, opportunistic operation. Defenders should continue to monitor the IP address 188.114.97.3 for re‑use, enforce brand‑monitoring rules for x.com, and ensure that URL filtering solutions include fedomex.com in their deny lists. Additional investigation of the WE1 certificate may reveal whether it was issued to a legitimate entity or forged for this campaign. Organizations should also advise users to treat any unsolicited messages promising crypto casino rewards as malicious and to report such URLs to their incident response teams.